VicOne Situational Awareness Report: 477 Cybersecurity Incidents, 160 Ransomware Cases, and Other Automotive Threat Highlights in Q2 2026

As an automotive cybersecurity leader, VicOne delivers threat intelligence and security insights tailored to the specialized needs of the modern mobility ecosystem. The VicOne Situational Awareness Report in Q2 2026 examines observed cybersecurity incidents, ransomware activity, Common Weakness Enumeration (CWE) findings, and AI-related risks from April through June 2026. 

Q2 2026 Highlights 

• VicOne observed 477 automotive-related cybersecurity incidents in Q2 2026, an almost 20% increase from Q1. 

• The Americas accounted for 245 incidents, representing more than 51% of the Q2 total.

• In-vehicle incidents increased from 129 to 168, the largest increase among the tracked domains.

• Ransomware activity declined to 160 incidents from 180 in Q1, but logistics and transportation still accounted for 40% of Q2 ransomware activity. 

• Logistics and transportation accounted for 64 ransomware incidents, or 40% of the Q2 total.

• Qilin was the most active named ransomware group, with 15 incidents.

• SQL injection was the most frequently observed CWE, appearing 24 times.
• AI-related risk extended beyond vehicle models to ECU modification tools, software packages, automation pipelines, and engineering workflows.

About the report

The VicOne Q2 2026 Situational Awareness Report examines automotive-related cybersecurity activity observed from April 1 through June 30, 2026.

The analysis covers:

• Reported cybersecurity incidents by region
• Affected automotive and mobility domains
• Ransomware activity and victim sectors
• Common Weakness Enumeration findings
• Relevant security research and vulnerability disclosures
• AI-related threats affecting automotive systems and development workflows

The results should be interpreted as a quarterly view of activity observed within VicOne’s monitoring scope. They do not represent every automotive cybersecurity incident worldwide. Quarter-to-quarter changes may reflect both shifts in threat activity and changes in publicly visible reporting.

What changed in the automotive threat landscape in Q2 2026? 

VicOne tracked 477 automotive-related cybersecurity incidents in Q2 2026, up from 405 in Q1. 

The 72-incident increase represents quarter-over-quarter growth of 17.8%. However, the change was not distributed evenly. The most substantial shifts appeared in regional concentration and in incidents affecting vehicle systems.

The Americas recorded the highest incident volume 

Figure 1. Regional distribution of observed automotive cybersecurity incidents in Q1 and Q2 2026 

The Americas became the region with the highest number of reported incidents, increasing from 140 to 245, a spike that accounted for over 51% of all Q2 incidents. Europe, which recorded the highest volume in Q1, saw incidents decline from 161 to 113. Europe is followed by Asia (68), while other regions accounted for a smaller share of observed activity. 

Which parts of the automotive ecosystem were most affected? 

Across affected domains, enterprise IT systems remained the most affected, with incidents increasing from 210 in Q1 to 230 in Q2. In-vehicle systems recorded the largest increase, rising from 129 incidents in Q1 to 168 in Q2. This was followed by operational technology systems (31), charging infrastructure (28), connected vehicle backend services (18), and vehicle companion apps (2). No affected domain recorded a quarter-over-quarter decline. 

Figure 2. Q2 incidents remained concentrated in enterprise IT, with stronger growth across vehicle-adjacent domains. 

Several Q2 incidents illustrate how cybersecurity risk can span both operational platforms and in-vehicle systems.  

• April 3, 2026: a fleet management software provider confirmed a disruption affecting one of its platforms, which impacted access to fleet dashboards, vehicle tracking, and maintenance scheduling for customers in the UK and US.  

• June 13, 2026: Research demonstrated that a 2021 vehicle’s infotainment system accepted USB software updates signed with publicly available Android Open Source Project (AOSP) test keys, allowing unauthorized software installation through physical access to the vehicle’s USB port. They dubbed the technique “EvilValet,” likening it to a malicious valet gaining access to the vehicle. 

In the Overlap Era, incidents like these show how a weakness or disruption in one part of the automotive ecosystem can create operational, security, or compliance implications elsewhere. 

What happened with automotive ransomware in Q2 2026?

Ransomware activity in Q2 2026 remained active across the automotive ecosystem, with the data showing differences in both actor distribution and affected industries. 

Ransomware activity and group distribution 

In Q2 2026, ransomware activity affecting the automotive industry declined to 160 incidents, compared to 180 in Q1. However, activity accelerated toward the end of the quarter. After dropping from 53 incidents in April to 46 in May, ransomware incidents rebounded to 61 in June, the quarter’s highest monthly total. 

Figure 3. Monthly ransomware activity affecting the automotive industry in Q2 2026 

Which ransomware groups were most active?

Qilin was the most active named group with 15 incidents. A few of their activities included claimed attacks against an automotive retail and distribution network in Ukraine in May 2026 and a car OEM’s subsidiary in Thailand in June 2026. The group was followed closely by The Gentlemen (14), LockBit (12), and Akira (11).  

Figure 4. Distribution of Q2 ransomware activity by named group 

Activity was also distributed across smaller groups, including DeadLock, DragonForce, Safepay, Aur0ra, INC Ransom, and NightSpire. The Other category still accounted for 81 incidents, or over half of the quarter’s ransomware activity, showing that Q2 activity was not driven by a single dominant actor. 

Which automotive sectors were most affected by ransomware?

In Q2, ransomware activity remained concentrated in logistics and transportation, with 64 incidents accounting for 40% of all ransomware activity. This was followed by suppliers (35), dealers and retailers (27), and OEMs (19). 

Figure 5. Logistics and transportation accounted for the largest share of Q2 ransomware incidents, reflecting continued exposure across fleet and supply chain operations. 

While overall ransomware activity declined quarter over quarter, logistics and transportation still increased from 61 incidents in Q1 to 64 in Q2, making it a more prominent target within the quarter’s victimology. 

The concentration on logistics and transportation aligns with VicOne CyberThreat Research Lab’s recent analysis: ransomware risk can extend beyond endpoint encryption and disrupt the connected platforms that coordinate fleet operations. Cyber resilience in this industry requires visibility across both corporate IT and the infrastructure that keeps vehicles, cargo, and routes moving. 

CWE analysis 

The Q2 CWE data shows a different weakness profile from the previous quarter, with injection-related issues becoming more prominent in the overall ranking. While this comparison should be read as a quarterly snapshot rather than a long-term trend, the results show that automotive cybersecurity weaknesses persist across both enterprise-facing systems and vehicle-adjacent technologies. 

What were the most common software weaknesses in Q2 2026?

Compared with Q1, which was more concentrated around authentication, session management, and credential protection, Q2 reflected greater visibility into input-handling and injection risks. 

Table 1. Top CWE entries observed in Q2 2026 vs Q1 2026 

What weaknesses affected charging infrastructure?

Compared to Q1, where the leading weaknesses were concentrated around authentication, session expiration, excessive authentication attempts, and credential protection, the charging infrastructure vulnerabilities in Q2 were more distributed across several lower-frequency weakness types. This suggests that observed charging infrastructure issues were not centered on a single weakness family, reinforcing the need to secure access control, default configurations, software update integrity, and system-level command handling. 

Table 2. Top charging infrastructure CWE entries observed in Q2 2026 compared to Q1 2026 

What weaknesses affected in-vehicle systems?

In Q2 2026, vehicle system vulnerabilities also showed a broader spread of CWEs. The Q2 list covered software robustness, memory safety, authentication, cryptography, and failure-state behavior. This breadth is significant for in-vehicle environments, where software flaws can affect diagnostics, communications, update flows, and other vehicle-adjacent functions. 

Table 3. Top CWE entries observed in in-vehicle systems in Q2 2026 compared to Q1 2026 

Which Q2 research findings matter to automotive security teams?

Several Q2 disclosures and research findings show how cybersecurity weaknesses can appear across enterprise systems, charging infrastructure, connected services, and in-vehicle platforms. 

• Enterprise and connected service exposure: A security researcher found API vulnerabilities in the cloud services behind a connected vehicle app, allowing one account holder to view vehicle data and pending requests belonging to other owners. The exposure has since been fixed, while other API issues were still being remediated. 

• Charging infrastructure vulnerabilities: Various security researchers disclosed vulnerabilities affecting several EV charging products, with proof-of-concept code publicly released for some flaws. The reported issues included authentication bypass and command injection, privilege escalation, and conditions that could enable arbitrary code execution. 

• Platform-level software exposure: Copy Fail (CVE-2026-31431) is a Linux kernel logic bug that allows an unprivileged local user to gain root access. While not vehicle-specific, the flaw may be relevant to automotive Linux deployments, where shared platform weaknesses can affect systems beyond a single vehicle component. 

• UDS Security Access weaknesses: At Black Hat Asia 2026, researchers unveiled AlgoBuster, a novel attack framework targeting UDS Service 0x27. By brute-forcing the algorithm itself rather than the full key space, AlgoBuster successfully broke 2 out of 12 tested ECUs. 

• Vehicle software supply chain exposure: Vulnerabilities CVE-2026-33524 and CVE-2026-33666 were identified in Zserio, the serialization framework behind the Navigation Data Standard (NDS). The findings illustrate how weaknesses in map delivery, supply chain pipelines, and backend processing could affect navigation and ADAS-related data integrity. 

How did AI change automotive cybersecurity risk in Q2 2026?

AI-related risk in Q2 2026 appeared in vehicle engineering workflows and in attacker adaptation to AI-assisted security processes. One notable example showed how AI tooling could lower the technical barrier for vehicle modification. An AI agent published on GitHub enabled automated ECU parameter modification and read/write assistance, making ECU tuning and aftermarket modifications more accessible to less specialized users. If emissions-related parameters are altered through such tooling, affected vehicles could fall out of conformance with Euro 7 and similar regulations. 

Threat actors also continued adapting to AI-assisted security workflows. A newer Shai-Hulud variant reportedly incorporated AI tool configuration and prompt-manipulation techniques to evade AI-assisted security analysis. After compromising software packages, attackers could use trusted automation workflows to spread infected releases, steal credentials, and propagate further. 

These cases suggest that AI-related automotive cybersecurity risk is not limited to AI models inside vehicles. It also extends to the tools, packages, automation pipelines, and engineering workflows that support modern automotive software development. 

Frequently asked questions

How many automotive cybersecurity incidents did VicOne observe in Q2 2026?

VicOne tracked 477 automotive-related cybersecurity incidents from April through June 2026. This was a 17.8% increase from the 405 incidents observed in Q1.

Which region recorded the most automotive cybersecurity incidents?

The Americas recorded 245 incidents, representing more than 51% of VicOne’s Q2 total. Europe followed with 113 incidents, and Asia recorded 68.

Did automotive ransomware increase in Q2 2026?

The quarterly total declined from 180 incidents in Q1 to 160 in Q2. However, monthly activity rose to 61 incidents in June, the highest monthly level of the quarter.

Which automotive sector was most affected by ransomware?

Logistics and transportation was the most affected sector, accounting for 64 incidents, or 40% of the Q2 ransomware total.

Which ransomware group was most active?

Qilin was the most active named group in VicOne’s Q2 observations, with 15 incidents. The Gentlemen followed with 14, LockBit with 12, and Akira with 11.

What was the most common software weakness?

CWE-89, SQL injection, was the most frequently observed weakness, appearing 24 times. General injection weaknesses under CWE-74 ranked second with 14 entries.

Where did AI-related automotive risk appear?

AI-related risk appeared in ECU modification tools, compromised software packages, prompt-manipulation techniques, automated development workflows, and other systems supporting automotive software engineering.

Conclusion 

The Q2 2026 data reinforces a central reality of the Overlap Era: automotive cybersecurity risk now spans enterprise systems, operational platforms, connected services, charging infrastructure, and in-vehicle software.  

While the quarter’s findings should be read as a snapshot rather than a long-term trend, the distribution of incidents, ransomware activity, CWE findings, and AI-related signals points to three priorities for automotive OEMs and organizations. 

1. Scale visibility across the wider automotive ecosystem. Security teams need visibility across the connected layers that support vehicle design, deployment, operations, maintenance, and updates. 

2. Strengthen resilience across logistics and operational dependencies. Ransomware exposure reinforces the need to secure the platforms, services, and third-party integrations that keep fleets, cargo, and routes moving. 

3. Secure software and automation pipelines by design. CWE and AI-related findings point to the need for stronger authentication, software integrity checks, secure CI/CD practices, third-party validation, and governance for AI-enabled engineering workflows. 

The organizations best prepared for the Overlap Era will be those that can see risk before it crosses boundaries. VicOne helps automotive organizations build this visibility through next-gen vehicle security operations centers (VSOCs) and AI-driven threat intelligence platforms, supporting faster detection, more informed response, and stronger resilience across the automotive value chain. 

Stay ahead of emerging automotive threats. Subscribe to xAurient Threat Alerts for timely intelligence on the risks shaping the connected mobility ecosystem.